SPAN not working after sniffer reboot

[d.camboni]

HI

I have a problem with a cisco catalyst 3750.

I need to monitoring a port network traffic.

The source port is 21 and the destination 22.

All run in default vlan 1

To do this:

-a network sniffer is connected to 22 port.

-I create a new vlan 10

-I put the port 22 in vlan 10 in access mode

-I create the monitor source port 21 destination vlan 10

All work until the pc with sniffer is rebooted.

After reboot the sniffer stop working and I need to delete and re-create the monitor in the switch.

Below part of switch configuration

Thanks Davide

!

!

!

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan internal allocation policy ascending

!

!

!

!

!

!

interface Port-channel1

!

interface Port-channel2

!

interface Port-channel3

!

interface GigabitEthernet1/0/1

description Nortel1-P1

channel-group 1 mode active

!

interface GigabitEthernet1/0/2

description Nortel1-P2

channel-group 1 mode active

!

interface GigabitEthernet1/0/3

description Nortel2-P1

channel-group 2 mode active

!

interface GigabitEthernet1/0/4

description Nortel2-P2

channel-group 2 mode active

!

interface GigabitEthernet1/0/5

description HPCed-C9

channel-group 3 mode active

!

interface GigabitEthernet1/0/6

!

interface GigabitEthernet1/0/7

!

interface GigabitEthernet1/0/8

!

interface GigabitEthernet1/0/9

!

interface GigabitEthernet1/0/10

!

interface GigabitEthernet1/0/11

!

interface GigabitEthernet1/0/12

!

interface GigabitEthernet1/0/13

!

interface GigabitEthernet1/0/14

!

interface GigabitEthernet1/0/15

!

interface GigabitEthernet1/0/16

!

interface GigabitEthernet1/0/17

!

interface GigabitEthernet1/0/18

!

interface GigabitEthernet1/0/19

!

interface GigabitEthernet1/0/20

!

interface GigabitEthernet1/0/21

load-interval 30

!

interface GigabitEthernet1/0/22

switchport access vlan 10

switchport mode access

load-interval 30

!

interface GigabitEthernet1/0/23

!

interface GigabitEthernet1/0/24

!

interface GigabitEthernet1/0/25

!

interface GigabitEthernet1/0/26

!

interface GigabitEthernet1/0/27

!

interface GigabitEthernet1/0/28

!

interface GigabitEthernet2/0/1

description Nortel1-P3

channel-group 1 mode active

!

interface GigabitEthernet2/0/2

description Nortel1-P4

channel-group 1 mode active

!

interface GigabitEthernet2/0/3

description Nortel2-P3

channel-group 2 mode active

!

interface GigabitEthernet2/0/4

description Nortel2-P4

channel-group 2 mode active

!

interface GigabitEthernet2/0/5

description HPCed-C10

channel-group 3 mode active

!

interface GigabitEthernet2/0/6

!

interface GigabitEthernet2/0/7

!

interface GigabitEthernet2/0/8

!

interface GigabitEthernet2/0/9

!

interface GigabitEthernet2/0/10

!

interface GigabitEthernet2/0/11

!

interface GigabitEthernet2/0/12

!

interface GigabitEthernet2/0/13

!

interface GigabitEthernet2/0/14

!

interface GigabitEthernet2/0/15

!

interface GigabitEthernet2/0/16

!

interface GigabitEthernet2/0/17

!

interface GigabitEthernet2/0/18

!

interface GigabitEthernet2/0/19

!

interface GigabitEthernet2/0/20

!

interface GigabitEthernet2/0/21

!

interface GigabitEthernet2/0/22

!

interface GigabitEthernet2/0/23

!

interface GigabitEthernet2/0/24

!

interface GigabitEthernet2/0/25

!

interface GigabitEthernet2/0/26

!

interface GigabitEthernet2/0/27

!

interface GigabitEthernet2/0/28

!

interface Vlan1

ip address 192.168.1.128 255.255.248.0

!

ip http server

ip http secure-server

!

!

logging esm config

snmp-server community public RO

!

!

line con 0

line vty 0 4

exec-timeout 0 0

password t3rm%aLf1

login

length 0

line vty 5 15

exec-timeout 0 0

password t3rm%aLf1

login

!

!

monitor session 1 source interface Gi1/0/21

monitor session 1 destination interface Gi1/0/22 encapsulation replicate ingress untagged vlan 10

end

[sherwood.c]

Did you ever get a reply to this question?  I am having the same issue with two different pairs of Juniper IDP's connected to 3750E stacks with IOS version 15.0(1)SE2.  They were working fine then after a reboot, which was done to turn off the web services on the IDP's, the monitoring ports stopped receiving traffic.  I was able to make them work again but only after implementing the following:

destination interface Gi1/0/30 ingress untagged vlan 120

This only came about with some trial and error and the only thing I can come up with is that there is possibly something that the IDP's want to send out after a restart that prevents the monitoring port from working correctly.  That said, I am not seeing anything on the input rate. But, after the change we started seeing alerts again and continue to see traffic on the output rate.

Does anyone have any thoughts on the matter?

Regards,

Curtis Sherwood

[Carlo Poggiarelli]

Hi

try to add spanning-tree portfast to both G1/0/21 and 22

HTH

Regards

Carlo

Please rate all helpful posts

"The more you help the more you learn"

[sherwood.c]

Thanks Carlo.

So you are thinking that perhaps the port does not come up quickly enough following a reboot and this is why it would stop receiving input?  Do you believe that adding the spanning-tree now without a reboot will force the ports to start receiving input?  I will not be able to test this until our next maintenance window which is in a couple of days so I will respind then and let you know.

Thanks again

Curtis